Table of Contents
LEGAL AND COMPLIANCE RISKS
Increasing and changing regulation of our businesses may adversely affect our ability to operate or harm our operating results.
We are subject to an increasing number of local, state, federal, and international laws, regulations, and rules and standards. These relate to, without limitation, labor,
advertising and marketing, tax, financial services, AI, data privacy and security, electronic funds transfer, money transmission, lending, digital content, consumer
protection, real estate, billing, e-commerce, promotions, quality of services, intellectual property ownership and infringement, import and export requirements, anti-
bribery and anti-corruption, insurance, foreign exchange controls and cash repatriation restrictions, antitrust and competition, environmental, health and safety, and
other regulated activities.
The legal and regulatory environment in which we operate is complex, varies across jurisdictions and is subject to frequent change and evolving interpretations. New
or amended laws, regulations, executive orders, directives, policies, and enforcement priorities may also be introduced. These dynamics affect our business. As we
expand our offerings and evolve our business models, we have, and may in the future, become subject to additional regulatory requirements and heightened
regulatory scrutiny. Our ability to adopt emerging technologies, including AI, and to innovate for our customers and operate our business may be harmed by the
uncertainty and complexity created by the evolving legal and regulatory environment. For example, in February 2025, the European Union's Artificial Intelligence Act
(AI Act) went into force regulating AI systems that affect individuals located in the EU. Additionally, countries and states are applying their data and consumer
protection laws to AI and/or enacting or considering legal frameworks on AI, including Utah, Colorado, and California. Compliance with these laws, and similar
emerging laws, may add significant costs to our business and may require us to change certain business practices to comply. In addition, some of our offerings, such
as our lending and payments products, require licenses to operate. Our inability to obtain or maintain a license, or to comply with current or new license requirements,
may materially harm our ability to operate in specific jurisdictions or subject us to regulatory fines or penalties.
The tax preparation industry continues to receive heightened attention from federal and state governments. New legislation, regulation, public policy considerations,
changes in the cybersecurity environment, litigation by the government or private entities, changes to or new interpretations of existing laws may result in greater
oversight of the tax preparation industry, restrict the types of products and services that we can offer or the prices we can charge, or otherwise cause us to change the
way we operate our tax businesses or offer our tax products and services. We are also required to comply with a variety of state revenue agency standards in order to
successfully operate our tax preparation and electronic filing services. Changes in state-imposed requirements by one or more of the states, including the required
use of specific technologies or technology standards, may significantly increase the costs of providing those services to our customers and may prevent us from
delivering a quality product to our customers in a timely manner.
Any perceived or actual failure to comply with applicable laws, regulations, and rules, including new interpretations of existing laws, regulations, and rules, could
negatively impact our reputation, expose us to legal liability, fines, penalties, or require us to change our offerings or business operations. In addition, evolving laws,
regulations, and rules may require us to modify our business practices or compliance programs in order to continue operating our businesses. Regulatory or
legislative changes and other actions that materially affect our business may be announced with little or no advance notice, and we may be unable to respond
quickly. As a result, we may face increased operating costs, reduced revenue opportunities, and may be unable to mitigate some or all of the adverse impacts those
changes may cause. Any of the foregoing may adversely affect our ability to operate and may harm our results of operations.
Complex and evolving privacy and data protection regulations or changing customer expectations could result in claims, changes to our business
practices, penalties or increased cost of operations or otherwise harm our business.
Regulations related to data privacy, cybersecurity, the collection, processing, storage, transfer and use of data, and the use of AI are evolving. Many jurisdictions in
which we operate globally have enacted, or are in the process of enacting, data privacy legislation or regulations aimed at creating and enhancing individual privacy
rights. For example, the General Data Protection Regulation (GDPR) regulates the collection, use, and retention of personal information by our offerings in the EU. In
addition, in the absence of a unified federal privacy standard, a growing number of U.S. states have enacted or introduced data privacy laws and regulations. Several
countries have established specific legal requirements for cross-border data transfers and governmental authorities and privacy advocates around the world continue
to propose new regulatory actions concerning data protection. Moreover, several jurisdictions are considering regulatory frameworks for AI that implicate data
protection laws.
In our efforts to meet the various data privacy regulations that apply to us, we have made and continue to make certain changes to our offerings, business practices,
and use of certain third party tools and vendors. Additionally, customer sensitivity to privacy continues to increase and our privacy statements and practices may
create additional customer expectations about the collection, use, and sharing of personal information.
In addition, the evolution of global privacy treaties and frameworks has created compliance uncertainty and increased complexity. For example, the judicial invalidation
of the EU-U.S. Privacy Shield and Safe Harbor frameworks that we relied on to transfer data created additional compliance challenges for the transfer of EU personal
data to the U.S. While a new EU-U.S. Data Privacy Framework currently provides a basis for us to transfer personal data from the European Union the U.S., the future
of this framework is uncertain because it faces legal challenges in the European courts.